emotet | 4b5b28547bf228c99b354ded564168de0bc3e8b84c25d99f1770a4f3493b41dd

Analysis

Target
emotet_exe_e5_4b5b28547bf228c99b354ded564168de0bc3e8b84c25d99f1770a4f3493b41dd_2022-01-28__000110.dll
Size 520KB
Sample220128-abhcaadcf5
SHA256 4b5b28547bf228c99b354ded564168de0bc3e8b84c25d99f1770a4f3493b41dd
MD5 9faaf5f9af692a2ac6d6045d7c25f793
SHA1 53858f7c5bab98eec44dda328c9b921383d19cee
SHA512 7b435a0062c6268a440d6801d07be0d1c556a7955561cb2f84810d0abe64a5fd6e9ce6e0d953ecc97fd844a382daf5c4c021e4b42976ada48a586972caf6978d
MD5 SHA1 SHA512

Score

10^/10

Family

Botnet

eck1.plain

ecs1.plain

Emotet
Emotet is a trojan that is primarily spread through spam emails.
trojan banker emotet

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 3448 wrote to memory of 4128	3448	regsvr32.exe	69
PID 3448 wrote to memory of 4128	3448	regsvr32.exe	69
PID 3448 wrote to memory of 4128	3448	regsvr32.exe	69
PID 4128 wrote to memory of 4052	4128	regsvr32.exe	70
PID 4128 wrote to memory of 4052	4128	regsvr32.exe	70
PID 4128 wrote to memory of 4052	4128	regsvr32.exe	70

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\emotet_exe_e5_4b5b28547bf228c99b354ded564168de0bc3e8b84c25d99f1770a4f3493b41dd_2022-01-28__000110.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:3448
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\emotet_exe_e5_4b5b28547bf228c99b354ded564168de0bc3e8b84c25d99f1770a4f3493b41dd_2022-01-28__000110.dll
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4128
- - C:\Windows\SysWOW64\rundll32.exe
    C:\Windows\SysWOW64\rundll32.exe "C:\Users\Admin\AppData\Local\Temp\emotet_exe_e5_4b5b28547bf228c99b354ded564168de0bc3e8b84c25d99f1770a4f3493b41dd_2022-01-28__000110.dll",DllRegisterServer
    3⤵
    PID:4052

memory/4128-118-0x00000000009A0000-0x00000000009C7000-memory.dmp

Download